Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,078 total in npm · sorted newest first- May 20, 2026
Malicious code in ts-logger-pack (npm)
6 compromised versions
- May 20, 2026
Malicious code in terminal-logger-utils (npm)
3 compromised versions
- May 20, 2026
Malicious code in @sec-loans-ui/utils (npm)
1 compromised version
- May 20, 2026
Malicious code in @riskine-frontend/design-elements (npm)
1 compromised version
- May 20, 2026
Malicious code in react-tracked-tony (npm)
1 compromised version
- May 20, 2026
Malicious code in qazaq-cli (npm)
1 compromised version
- May 20, 2026
Malicious code in promptbook-cli (npm)
1 compromised version
- May 20, 2026
Malicious code in promptbook-mcp (npm)
1 compromised version
- May 20, 2026
Malicious code in fca-official-uzair-rajput (npm)
1 compromised version
- May 20, 2026
Malicious code in security-env-loader (npm)
1 compromised version
- May 20, 2026
Malicious code in @touchvue/chat (npm)
3 compromised versions
- May 20, 2026
Malicious code in fulcrum-sessions (npm)
2 compromised versions
- May 20, 2026
Malicious code in axiosqqq (npm)
4 compromised versions
- May 20, 2026
Malicious code in bucket-protocol-sdk-v2 (npm)
7 compromised versions
- May 20, 2026
Malicious code in @pluxee-connect/api-client (npm)
2 compromised versions
- May 20, 2026
Malicious code in mcp-server-iehub-proxy (npm)
1 compromised version
- May 20, 2026
Malicious code in @tailwind-core/oxide-win32-x64-msvc (npm)
1 compromised version
- May 20, 2026
Malicious code in figma-d2c-utils (npm)
1 compromised version
- May 20, 2026
Malicious code in @thesignup/cli (npm)
1 compromised version
- May 20, 2026
Malicious code in @web-3d-tool/sdk (npm)
1 compromised version
- May 20, 2026
Malicious code in @serviceshub/x-web-core (npm)
1 compromised version
- May 20, 2026
Malicious code in ethers-wallet-packages (npm)
2 compromised versions
- May 20, 2026
Malicious code in python-utils (npm)
1 compromised version
- May 20, 2026
Malicious code in cb-wallet-data (npm)
1 compromised version
- May 20, 2026
Malicious code in vestibulect (npm)
1 compromised version
- May 20, 2026
Malicious code in @trackking/core (npm)
1 compromised version
- May 20, 2026
Malicious code in @ikyyofc/gemini-cli (npm)
17 compromised versions
- May 20, 2026
Malicious code in @vtmn-play/react (npm)
1 compromised version
- May 20, 2026
Malicious code in @wengine-ai/claude-code-router-shared (npm)
7 compromised versions
- May 20, 2026
Malicious code in wallet-agent-ai-radix (npm)
1 compromised version
- May 20, 2026
Malicious code in color-style-utils (npm)
7 compromised versions
- May 20, 2026
Malicious code in @flipbit2-bb/test-auth-state (npm)
1 compromised version
- May 20, 2026
Malicious code in @deadcode09284814/axios-util (npm)
2 compromised versions
- May 20, 2026
Malicious code in chalk-tempalte (npm)
6 compromised versions
- May 20, 2026
Malicious code in cloud-pc-templates (npm)
1 compromised version
- May 20, 2026
Malicious code in ezymail (npm)
6 compromised versions
- May 20, 2026
Malicious code in @venturo/playwright (npm)
1 compromised version
- May 20, 2026
Malicious code in pulse-axios (npm)
3 compromised versions
- May 20, 2026
Malicious code in foundy-toolkit (npm)
1 compromised version
- May 20, 2026
Malicious code in rdflib (npm)
1 compromised version
- May 20, 2026
Malicious code in axois-utils (npm)
6 compromised versions
- May 20, 2026
Malicious code in carvus-lens (npm)
1 compromised version
- May 20, 2026
Malicious code in polymarket-clob-client (npm)
1 compromised version
- May 20, 2026
Malicious code in @shinzepelly/libsignal-node (npm)
1 compromised version
- May 20, 2026
Malicious code in @tailwind-core/webpack (npm)
1 compromised version
- May 20, 2026
Malicious code in @solarcraft/observix (npm)
1 compromised version
- May 20, 2026
Malicious code in get-deps-path (npm)
6 compromised versions
- May 20, 2026
Malicious code in fca-eryxenx (npm)
1 compromised version
- May 20, 2026
Malicious code in truffle-config-helper (npm)
1 compromised version
- May 20, 2026
Malicious code in customerdigital-ui-containers-lib (npm)
3 compromised versions
Page 89 of 4,802